The vulnerability is a missing authorization check for extensions, allowing attackers to craft malicious extensions that can read cross‑origin data from other web pages loaded in Chrome. This flaw does not require sandbox escape; the attacker simply exploits the extension’s elevated privileges to exfiltrate sensitive information. The underlying weakness is a missing authorization (CWE‑862) combined with improper memory management (CWE‑825). As a result, user privacy can be compromised without executing arbitrary code.

All desktop users running Google Chrome versions earlier than 156.0.8078.47 are affected. The flaw resides in the core Chromium engine that processes extensions, so any third‑party or packaged extension can become a vector. The impacted product is Google:Chrome on Windows, macOS, and Linux.

The CVSS score is 8.8 and the EPSS score is less than 1%, indicating low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a malicious extension installed by the user or through a compromised Chrome Web Store page. Until Chrome is updated, the risk is high for users who have the affected version installed.